Google PCA Practice Test 30 — 15 Questions

Question 1

A company wants to monitor their Cloud Run services for errors and latency. Which Google Cloud product should they use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) provides comprehensive observability for Cloud Run services, including built-in dashboards for request latency, error rates, and resource utilization. It collects metrics like request count, request latencies, and container instance counts, and allows you to set alerting policies based on these metrics. While Cloud Trace can help with latency analysis and Cloud Logging captures logs, Cloud Monitoring is the primary product for monitoring both errors and latency in a unified view.

Answer

Cloud Trace

Answer

Cloud Logging

Answer

Error Reporting

Question 2

An organization runs a stateful application on GKE that must not lose data during cluster upgrades or node repairs. The application uses persistent volumes with ReadWriteOnce access mode. The team wants to ensure pods are not evicted simultaneously. Which Kubernetes resource should they configure?

Accepted Answer

PodDisruptionBudget. A PodDisruptionBudget (PDB) limits how many pods of a given workload can be voluntarily disrupted at once, ensuring that during node drains (cluster upgrades, node repairs) not all replicas of a stateful application are evicted simultaneously. By setting minAvailable or maxUnavailable, the PDB forces the eviction API to respect availability constraints, protecting data integrity for ReadWriteOnce volumes that cannot be mounted by multiple pods at once.

Answer

ClusterAutoscaler

Answer

HorizontalPodAutoscaler

Answer

VerticalPodAutoscaler

Question 3

Match each GCP compute service to its characteristic.

Accepted Answer

Compute Engine: Virtual machines on demand, IaaS.. Compute Engine provides IaaS virtual machines; GKE offers managed Kubernetes; Cloud Run enables serverless containers; App Engine is a PaaS for web apps. Common confusions include mixing serverless and Kubernetes features.

Answer

Compute Engine: Managed Kubernetes clusters.

Answer

Google Kubernetes Engine: Serverless container execution.

Answer

Cloud Run: PaaS for web apps with auto-scaling.

Question 4

You need to create a private GKE cluster with Workload Identity enabled to allow pods to access Google Cloud APIs without static service account keys. What must you configure for the cluster?

Accepted Answer

Enable Workload Identity on the cluster and set the --workload-pool flag at cluster creation. To enable Workload Identity on a GKE cluster, you must enable it at the cluster level and specify the workload pool using the --workload-pool flag (e.g., PROJECT_ID.svc.id.goog) during cluster creation. This establishes the trust relationship between Kubernetes service accounts and Google Cloud IAM, allowing pods to impersonate IAM service accounts without static keys.

Answer

Enable Binary Authorization on the cluster

Answer

Create a node pool with a service account that has the necessary IAM roles and assign that SA to pods

Answer

Use Cloud NAT to allow pods to communicate with Google APIs

Question 5

A security engineer is configuring VPC Service Controls to protect a project containing BigQuery datasets with PII. They want to prevent data exfiltration while allowing authorized users to query the data from outside the perimeter. Which configuration meets these requirements?

Accepted Answer

Create a perimeter that includes the project, and use an access level from Access Context Manager to grant access to authorized users.. VPC Service Controls use Access Context Manager (ACM) access levels to define granular, identity-based access conditions. By including the project in a perimeter and applying an access level that specifies authorized users (e.g., based on IP ranges, device state, or identity), you can allow those users to query BigQuery from outside the perimeter while blocking all other external traffic, preventing data exfiltration.

Answer

Create a perimeter that includes the project, and set the 'allowed external access' flag to true.

Answer

Create a perimeter and enable the 'exfiltration exception' for BigQuery.

Answer

Create a perimeter that includes only Compute Engine instances, and use a separate perimeter for BigQuery.

Question 6

An organization wants to connect their on-premises data center to Google Cloud with a dedicated 10 Gbps link. They require high availability and have budget for two physically diverse connections. Which solution should they choose?

Accepted Answer

Provision two Cloud Dedicated Interconnect connections from diverse peering points.. Two Dedicated Interconnect connections from diverse peering points provide the required 10 Gbps dedicated bandwidth with high availability, since each connection is physically separate and can fail independently. This is the standard Google-recommended topology for production Dedicated Interconnect with redundancy.

Answer

Use Partner Interconnect with a single 10 Gbps connection.

Answer

Configure a single Dedicated Interconnect connection and use Cloud VPN as backup.

Answer

Deploy a single HA VPN tunnel.

Question 7

Which THREE Google Cloud services can be used to implement a zero-trust architecture for network security? (Choose three.)

Accepted Answer

Cloud Armor. Cloud Armor is correct because it provides web application firewall (WAF) and DDoS protection at the edge of Google's network, enforcing security policies based on IP addresses, geo-locations, and Layer 7 attributes. This aligns with zero-trust principles by inspecting and filtering traffic before it reaches the application, ensuring that only authorized requests are allowed, regardless of the network perimeter.

Answer

VPC Networks

Answer

Cloud VPN

Question 8

An engineer runs the command above. A few days later, the instance becomes unresponsive. Upon investigation, you find that the boot disk is 100 GB and 95% full. The data disk is 500 GB and only 20% full. What is the most likely cause of the unresponsiveness?

Accepted Answer

The boot disk is too small and has run out of space.. The boot disk is 95% full, which leaves insufficient free space for the operating system to write temporary files, logs, or perform essential system operations. When a Linux or Windows boot disk runs out of space, the OS can become unresponsive because critical processes (e.g., systemd, journald, or the Windows Registry) cannot write to disk. In Google Cloud, the boot disk is the root device (typically /dev/sda1), and filling it to 95% on a 100 GB disk means only 5 GB remains, which is easily exhausted by normal system activity.

Answer

The data disk is pd-standard, which is causing I/O bottlenecks for the OS.

Answer

The boot disk is pd-ssd, which is too slow for the workload.

Answer

The instance has run out of IOPS on the boot disk.

Question 9

An organization is migrating a MySQL database to Cloud SQL. They require automatic failover with zero data loss in the event of a zone outage. Which configuration should they use?

Accepted Answer

Cloud SQL with high availability (HA) configuration.. Cloud SQL's high availability (HA) configuration uses a synchronous write to a standby instance in a different zone within the same region. This ensures that every transaction committed on the primary is also committed on the standby before acknowledging the client, guaranteeing zero data loss during a zone outage. Automatic failover to the standby occurs with no manual intervention, meeting both the automatic failover and zero data loss requirements.

Answer

Cloud SQL with a cross-region replica.

Answer

Cloud SQL with automated backups and binary logging.

Answer

Cloud SQL with a read replica in a different zone.

Question 10

A security team wants to prevent data exfiltration from a GKE cluster to external storage. They need to restrict access to Cloud Storage buckets from the cluster without using private IPs. Which solution should they implement?

Accepted Answer

Implement VPC Service Controls with a service perimeter. VPC Service Controls use service perimeters to protect resources and prevent data exfiltration from authorized networks, including GKE clusters, to external resources.

Answer

Configure firewall rules to block outbound traffic to Cloud Storage

Answer

Enable Cloud Armor on the GKE cluster

Answer

Use Private Google Access for on-premises access

Question 11

A company is deploying a multi-tier web application on Google Cloud. The application must comply with PCI DSS. Which combination of Google Cloud services should be used to restrict access to the database tier to only the application tier, while also encrypting data at rest and in transit?

Accepted Answer

Use Cloud SQL with private IP and SSL/TLS, and enable Cloud Key Management Service (KMS) to create a key ring and customer-managed encryption key (CMEK). It meets all PCI DSS requirements: Cloud SQL with private IP ensures the database tier is not exposed to the public internet, restricting access to only the application tier within the same VPC. SSL/TLS encrypts data in transit, and using Cloud KMS with a customer-managed encryption key (CMEK) provides control over encryption keys for data at rest, which is often required for compliance.

Answer

Use Cloud Spanner with private IP and SSL/TLS, and enable Google-managed encryption keys

Answer

Use Cloud SQL with public IP and SSL/TLS, and enable Google-managed encryption keys

Answer

Use Cloud Datastore with secure WebSocket connections and enable customer-managed encryption keys

Question 12

A company uses Cloud Armor to protect their HTTP load balancer. They need to block traffic from a specific set of IP addresses and also prevent SQL injection attacks. Which two configurations should they use? (Choose TWO.)

Accepted Answer

Security policies with IP deny rules. Option D is correct because Cloud Armor security policies support IP deny rules (e.g., a rule with action 'deny(403)' and a srcIpRanges match condition) that block traffic from a specified set of source IP addresses at the HTTP(S) load balancer edge. Option E is correct because Cloud Armor provides preconfigured WAF rules, including the 'sqli' (SQL injection) rule set based on ModSecurity CRS signatures, which detect and block SQL injection attempts when attached to the backend service. Options A, B, and C are incorrect: IAM roles govern identity and API access rather than filtering malicious HTTP traffic, VM firewall rules and VPC ingress rules operate at Layers 3/4 on instances or subnets and cannot inspect HTTP payloads for SQL injection, and they are not the Cloud Armor mechanism for protecting an HTTP(S) load balancer.

Answer

IAM roles to restrict access

Answer

Firewall rules on the VM instances

Answer

Ingress rules on the VPC network

Question 13

Your company runs a stateful web application on Compute Engine instances in a managed instance group (MIG) with autoscaling based on CPU utilization. The application maintains session state in memory on each instance. Recently, users have been experiencing session timeouts and data loss during scaling events. Additionally, the application's performance degrades under load due to frequent database queries for session data. You need to design a solution that ensures session persistence, improves performance, and minimizes application changes. The application is written in Java and uses Tomcat. Which of the following should you do?

Accepted Answer

Deploy Cloud Memorystore for Redis as a session store, and configure Tomcat to use Redis-backed session persistence using the Redisson or Spring Session framework.. It introduces an external, highly available, in-memory session store (Cloud Memorystore for Redis) that decouples session state from individual Compute Engine instances. This eliminates session loss during autoscaling events and reduces database load by serving session data from fast Redis memory, all while requiring minimal application changes via Tomcat's built-in session persistence or Spring Session integration.

Answer

Rewrite the application to be stateless by moving all state to the frontend using JWT tokens, eliminating the need for server-side sessions.

Answer

Configure the load balancer to use session affinity (sticky sessions) and increase the instance size to handle more sessions per instance.

Answer

Store session data in Cloud SQL using Spring Session JDBC, and configure the application to retrieve sessions from the database.

Question 14

A developer needs to pass a startup script to a Compute Engine instance during creation. Which method should be used to ensure the script runs on first boot?

Accepted Answer

Use gcloud compute instances create with --metadata=startup-script=.... The `--metadata=startup-script=...` flag on `gcloud compute instances create` passes the script as instance metadata. Compute Engine automatically executes the value of the `startup-script` metadata key on every boot, including the first boot. This is the standard, documented method for providing a startup script at instance creation time.

Answer

Create a custom image with the script baked in.

Answer

Use gcloud compute instances add-metadata after creating the instance.

Answer

Use gcloud compute instances create with --startup-script flag.

Question 15

A company is migrating a legacy on-premises application to Google Cloud. The application has strict low-latency requirements between its components and requires stateful TCP sessions. Which TWO design decisions should the architect recommend?

Accepted Answer

Use regional managed instance groups with internal load balancing.. Regional managed instance groups (MIGs) with internal load balancing are correct because they keep all compute instances within a single region, minimizing network hops and latency between components. Internal load balancing provides a single IP address for stateful TCP sessions without introducing the latency of a global proxy, and it supports session affinity (e.g., client IP affinity) to maintain stateful connections.

Answer

Use Cloud NAT for outbound connectivity.

Answer

Use global load balancing with Cloud CDN.

Answer

Use Cloud VPN for on-premises connectivity.